We recently just deployed LEM into our environment and I am having issues with setting up a rule/filter. I am unsure if this should be a rule initially before filtering or vise versa. Nevertheless, I am working on a close network so no traffic internally can get outside and vise versa. I want to create a filter or rule that will show me if any (DNS) query that is performed from an address outside our network. Additionally, is it possible to get that filter to display on the dashboard as a widget within the "OPS Center" tab. I haven't seen any DNS related filter that could help me accomplish this as of yet?
Please assist